The UAE employs a multi-jurisdictional approach to the regulation of virtual asset activities, with oversight distributed across federal regulators, an emirate-level regulator in Dubai, and the financial free zones, each operating under its own legal and regulatory framework. The applicable regime depends on the jurisdiction of incorporation and operation.

Onshore UAE

Central Bank of the UAE (CBUAE)

The CBUAE regulates payment tokens and licensed financial institutions at the federal level. Under the Payment Token Services Regulation 2024 (Circular No 2/2024) (PTSR), no person may issue, convert, custody, transfer or promote payment tokens, namely fiat-referenced stablecoins, in or from the UAE without the relevant CBUAE licence or registration. The PTSR distinguishes between Dirham Payment Tokens, namely AED-denominated stablecoins, which require a CBUAE licence, and Foreign Payment Tokens, namely non-AED stablecoins, for which the foreign issuer must obtain CBUAE registration as a Registered Foreign Payment Token Issuer. Approved Dirham Payment Token issuers to date include AE Coin, Zand AED, RAKBANK’s AED stablecoin and the IHC-led DDSC.

Available authorisations under the PTSR are: (i) Licensed Payment Token Issuer (Dirham); (ii) Registered Foreign Payment Token Issuer; (iii) Licensed or Registered Payment Token Conversion Provider; and (iv) Licensed or Registered Payment Token Custodian and Transferor.

VASPs already licensed by the CMA or VARA for stablecoin custody, transfer or conversion must apply for a Non-Objection Registration to continue those services.

Capital Market Authority (CMA)

The CMA, formerly the Securities and Commodities Authority (SCA), restructured under Federal Decree-Laws Nos 32 and 33 of 2025 with effect from 1 January 2026, regulates capital markets at the federal level, with authority extending to virtual assets used for investment purposes, excluding the financial free zones, and with VASP licensing in the Emirate of Dubai delegated to VARA pursuant to Cabinet Resolution No 112 of 2022. Its remit covers the licensing and oversight of crypto trading platforms and other VASPs, including dealers, brokers, custodians, advisers and portfolio managers, as well as the development of the federal regulatory framework.

On 13 February 2026, the CMA issued Decision No 4/R.M/2026, a standalone VASP rulebook that supersedes Decision No 26/R.M/2023 and repeals the virtual asset provisions of the prior SCA Financial Activities Rulebook. The framework is structured across three modules, namely the General Framework Module, the Business Regulation Module and the Alternative Trading System Module, and licenses eight distinct VASP activities: (i) dealing in virtual assets as principal; (ii) dealing in virtual assets as agent; (iii) providing custody; (iv) arranging custody; (v) operating a multi-party trading platform; (vi) providing investment advice; (vii) portfolio management; and (viii) arranging investment transactions.

Virtual Assets Regulatory Authority (VARA)

VARA was established under Dubai Law No 4 of 2022 and is the competent authority for virtual asset activities across the Emirate of Dubai, excluding the DIFC, pursuant to powers delegated by the CMA under Cabinet Resolution No 112 of 2022. Its regime is set out in the Virtual Assets and Related Activities Regulations 2023, as updated by VARA Rulebook Version 2.0 published in May 2025 and in force from 19 June 2025, and licenses seven VA Activities, namely advisory, broker-dealer, custody, exchange, lending and borrowing, payments and remittances, and management and investment services, together with VA Issuance as a separate authorised activity. Each activity is governed by a dedicated rulebook, supplemented by compulsory rulebooks on company, compliance, market conduct, and technology and information.

In addition, VARA issues and enforces the Marketing Regulations governing all forms of virtual asset marketing, advertising and promotional activity directed at persons in the UAE, which apply on a UAE-wide basis.

Financial Free Zones

Abu Dhabi Global Market/Financial Services Regulatory Authority (ADGM/FSRA)

The FSRA regulates financial services, including virtual asset activities, within the ADGM financial free zone under the Financial Services and Markets Regulations 2015 (FSMR). Virtual assets are treated as commodities, with regulated activities including operating a Multilateral Trading Facility (MTF), dealing, custody, advising, managing and arranging, all requiring FSRA authorisation, supplemented by the FSRA’s Guidance on the Regulation of Virtual Asset Activities, most recently updated in June 2025. Only Accepted Virtual Assets may be offered to clients. The FSRA’s Fiat-Referenced Token (FRT) framework, in force from 1 January 2026, establishes a risk-tiered regime for fiat-backed stablecoin issuance, under which Paxos Issuance MENA and Universal Digital are licensed to issue USD-backed stablecoins.

Dubai International Financial Centre/Dubai Financial Services Authority (DIFC/DFSA)

The DFSA regulates financial services within the DIFC financial free zone under its own statutory framework, with virtual asset activities governed by the Crypto Token regime introduced in 2022 and the Investment Tokens regime for tokenised securities. Only Recognised Crypto Tokens may be used in DIFC financial services. The DFSA’s Tokenisation Regulatory Sandbox, launched in 2025, supports firms developing tokenised investment products such as equities, bonds, sukuk, fund units and other real-world assets, expressly excluding crypto tokens and stablecoins. Enhanced governance standards came into force on 12 January 2026, and the DFSA separately banned the use of privacy tokens on DIFC exchanges from January 2026.

International Alignment

The UAE has demonstrated a strong commitment to aligning with international regulatory standards. Under the Financial Action Task Force (FATF) guidance, the UAE has implemented a range of anti-money laundering and counter-financing of terrorism (AML/CFT) reforms, including mandatory Travel Rule compliance for all crypto firms, enhanced financial crime enforcement and improved international cooperation. All UAE virtual asset regulators require VASPs to comply with FATF Recommendations 15 and 16, covering virtual asset oversight and the Travel Rule respectively.

At the broader international level, the UAE’s regulators have sought to implement the “same activity, same risk, same regulation” principle promoted by the International Organization of Securities Commissions (IOSCO) in its 2023 crypto and digital asset policy recommendations, with the DFSA and FSRA in particular adopting frameworks that closely mirror their conventional financial services regimes. The UAE has also committed to the OECD Crypto-Asset Reporting Framework (CARF), having signed the relevant multilateral agreement in July 2025, reflecting further alignment with international transparency standards.

Classification

Each UAE regulator adopts its own definition of virtual assets, reflecting its particular regulatory mandate. At the federal level, the CMA defines virtual assets as digital representations of value that may be digitally traded or transferred and used for investment purposes, excluding digital representations of fiat currencies, securities or other funds. The CBUAE’s definition under Federal Decree-Law No 6 of 2025 is broader, covering digital representations of value or rights that can be transferred and stored electronically using distributed ledger technology. VARA’s definition is the widest, expressly including virtual tokens and any digital representation used as a means of exchange or payment.

Within the financial free zones, the FSRA in ADGM focuses on the functional characteristics of virtual assets as a medium of exchange, unit of account or store of value, while the DFSA in DIFC operates with a dual framework, namely a broad definition of Digital Assets under the Digital Assets Law No 2 of 2024, and a narrower definition of Crypto Tokens in its rulebook covering tokens used as a medium of exchange or for payment or investment purposes.

Prohibited Activities

Privacy tokens and algorithmic stablecoins are prohibited across all UAE jurisdictions.

Retail and Professional Client Distinction

Both the CMA and VARA frameworks establish tiered client classifications.

Under the CMA framework, clients are classified as retail investors, professional investors or counterparties. Professional investors fall into three sub-categories: professional by nature, covering institutions, governments, central banks, regulated entities, listed companies and similar bodies; professional by service, covering credit facility providers and arrangers of structured financing transactions; and professional by assessment, which includes natural persons with net assets of at least AED4 million excluding primary residence, certified or appropriately experienced individuals, and qualifying undertakings meeting specified financial thresholds. Counterparties are licensed entities that also qualify as professional investors by nature. The default classification is retail unless a client meets the criteria for a higher category, and classifications must be reviewed every three years.

Under the VARA framework, three investor categories apply: retail investors; qualified investors, namely individuals meeting a net asset threshold of AED3.5 million or an annual income of at least AED700,000, with virtual assets capped at 50% of the net asset calculation; and institutional investors, namely entities regulated by competent financial authorities. Enhanced consumer protection and suitability requirements apply to retail clients under both regimes. The financial free zones apply their own professional client classifications, broadly aligned with their conventional financial services frameworks.

Upcoming Regulations

The most significant near-term development is the transitional period under Federal Decree-Law No 6 of 2025, which extended CBUAE oversight to virtual asset payment services and DeFi-related activities, with existing operators required to comply or cease in-scope activities by September 2026.

The CMA and VARA formalised a mutual recognition framework in August 2025, enabling VASP licences issued by either authority to be recognised by the other, with joint supervisory protocols being implemented on an ongoing basis. At the international level, the UAE’s CARF reporting obligations take effect from 2027.

The use of a fund or other legal wrapper does not materially alter the analysis set out above. Regulated activities involving virtual assets require authorisation from the relevant regulator regardless of the vehicle through which they are conducted, and the interposition of a fund structure does not affect the licensing, prudential or conduct obligations applicable to the underlying activity.

Onshore UAE

VARA operates the most developed token issuance regime in the UAE. Under the Virtual Asset Issuance Rulebook, virtual assets are classified into three categories. Category 1 VAs, namely fiat-referenced virtual assets and asset-referenced virtual assets, require the issuer to hold a VARA licence. Category 2 VAs, namely all other non-exempt virtual assets, do not require the issuer to obtain a licence but may only be offered to persons in the UAE through a VARA-licensed distributor. Exempt VAs may be issued without prior registration or approval.

Issuers of Category 1 and Category 2 VAs must publish a White Paper prior to issuance. The White Paper must be machine-readable and kept updated, and records must be maintained for eight years following the cessation of the virtual asset’s circulation. A Risk Disclosure Statement must accompany the offering, and no marketing materials may be published until the relevant White Paper has been made available.

The CBUAE separately regulates the issuance of AED-referenced payment tokens under the PTSR. The CMA does not currently operate a regulatory framework for token issuance.

Financial Free Zones

Neither the DFSA nor the FSRA operates a standalone ICO or TGE regime. In ADGM, tokens exhibiting the characteristics of a security are regulated as Digital Securities under the FSRA’s securities framework, and the issuance of fiat-referenced tokens is subject to the FSRA’s dedicated FRT issuance framework, in force from 1 January 2026. In the DIFC, security tokens require a prospectus compliant with the DIFC Markets Law 2012, while non-security crypto tokens are not subject to a dedicated issuance regime and are instead regulated at the point of trading under the firm-led suitability assessment framework that came into force in January 2026.

Onshore UAE

The UAE’s market abuse framework was materially expanded and modernised on 1 January 2026 through the entry into force of Federal Decree-Law No 33 of 2025 (the “Capital Markets Law”), which codified a statutory market abuse regime at the federal level. Article 37 of the Capital Markets Law expressly prohibits unlawful practices, including trading with intent to deceive or mislead investors, market manipulation and insider dealing. The law delineates insider trading offences, capturing both direct trading and indirect dealings by any person in possession of inside information, and sets out a developed suite of market manipulation offences, including manipulative trading practices, the dissemination of false or misleading statements, and the incitement or circulation of rumours capable of influencing securities prices, issuer valuations or investor decision-making. Virtual assets are integrated into the capital markets perimeter under the new framework, with the CMA’s enforcement powers significantly strengthened through enhanced administrative sanctions, criminal referrals and a tiered penalty regime. The Capital Markets Law applies extra-territorially to any person targeting clients within the UAE, including from a financial free zone.

VARA operates the most developed activity-specific market abuse framework for virtual assets in the UAE. The Market Conduct Rulebook prohibits market manipulation, insider trading and misleading conduct. Prohibited behaviour includes trading on material non-public information, spreading false or misleading information to influence prices, wash trading and other forms of artificial volume creation, spoofing and layering, and front-running of client orders. Licensed VASPs are subject to suspicious activity reporting obligations where manipulative or abusive conduct is detected. The framework is broadly analogous in structure to the market abuse regime applicable to traditional securities, though adapted to the decentralised and continuous nature of crypto markets, namely the absence of a single trading venue means that manipulation analysis cannot be anchored to a specific exchange.

The federal Penal Code (Federal Decree-Law No 31 of 2021) and AML/CFT legislation provide an additional baseline of fraud and breach of trust offences, which apply to virtual asset activity by extension.

Financial Free Zones

In ADGM, market abuse is addressed through Parts 8 and 9 of the Financial Services and Markets Regulations 2015 (FSMR), supplemented by the FSRA’s Code of Market Conduct, which together prohibit insider dealing, market manipulation and the improper disclosure of inside information in terms modelled on UK and EU market abuse frameworks. Virtual assets are treated as a distinct asset class under the FSRA’s framework rather than as securities, and the market abuse provisions of the FSMR are capable of capturing virtual asset activity where the jurisdictional nexus to ADGM is established. The FSRA’s conduct of business rules impose additional obligations on authorised firms to detect and prevent manipulative and abusive trading strategies.

In the DIFC, market abuse is governed by the DIFC Markets Law 2012 and the DFSA’s Code of Market Conduct, which together prohibit insider dealing, market manipulation and misleading disclosure. The regime is extra-territorial in scope and applies to Investments generally, including crypto tokens admitted to trading on DIFC-regulated venues, and updated rules effective January 2026 further refine the framework. In practice, market abuse enforcement is concentrated around conduct affecting DIFC-regulated trading venues and DIFC market users.

Enforcement of virtual asset regulations in the UAE has intensified markedly. VARA has emerged as the most active enforcement body, issuing sanctions for a range of violations including unlicensed operations and breaches of the Marketing Regulations. In one of its largest single actions, VARA penalised 19 entities simultaneously, imposing fines alongside cease-and-desist orders. Most recently, in March 2026, VARA issued a public market alert directing several entities operating under a major international exchange brand to immediately cease all virtual asset activity in Dubai, none of the named entities holding a licence under VARA, the FSRA or the DFSA.

VARA’s enforcement remit extends expressly to overseas firms targeting Dubai audiences. Since the Marketing Regulations took effect on 1 October 2024, it has been unlawful for any unlicensed entity, including those based abroad, to advertise or promote virtual asset services to Dubai and UAE residents through any channel. VARA has applied this framework to sanction foreign firms, including a Singapore-based payment technology provider and an offshore exchange operator, for unlicensed marketing activity directed at Dubai users.

The regulatory posture across the UAE is likely to become more assertive over the next 12 months. VARA’s escalating enforcement cadence, the consolidation of federal oversight under the CMA, and the UAE’s ongoing FATF compliance commitments together point toward a stricter and more coordinated approach to cross-jurisdictional activity. Firms operating in or marketing into the UAE without appropriate authorisation can expect continued and heightened scrutiny.

The trigger for licensing is the conduct of a regulated virtual asset activity in or from the relevant jurisdiction, rather than mere establishment or incorporation. The UAE operates multiple parallel licensing frameworks. VARA governs virtual asset service providers in Dubai, while the CMA regulates the conduct of capital market activities involving virtual assets on the UAE mainland, with the FSRA and the DFSA operating equivalent regimes within ADGM and the DIFC respectively.

The licensing obligation applies on a substance-over-form basis and extends to entities operating from outside the UAE. Where a firm provides virtual asset services to UAE or Dubai residents, regardless of where it is incorporated or where its servers are located, it is expected to hold the appropriate licence from the relevant regulator. VARA has taken an active position on this point: its Marketing Regulations, in force since October 2024, prohibit unlicensed entities, including overseas firms, from advertising or promoting virtual asset services to Dubai and UAE residents through any channel. This position was reinforced by VARA’s March 2026 enforcement action against several entities operating under a major international exchange brand, which were ordered to cease all activity in Dubai despite having no physical presence in the emirate (see 2.6 Non-Compliance).

As to grandfathering, when VARA published Rulebook Version 2.0 in May 2025, existing licensees were afforded a 30-day transition period to achieve compliance with the updated requirements, with full compliance required by 19 June 2025. At the federal level, following the enactment of the CMA Decree-Laws in late 2025, entities previously licensed by the SCA have a one-year transitional period expiring on 1 January 2027 within which to align with the new framework. Pre-existing Cabinet decisions and SCA resolutions continue to apply in the interim to the extent they do not conflict with the new laws. There are no equivalent grandfathering provisions for firms that were operating without a licence, and unlicensed entities are not permitted to continue operating during any transitional period.

Onshore UAE

VARA

Applicants for a VARA licence must be incorporated in Dubai. VARA operates a rulebook-based compliance framework under which all licensed entities must comply with four compulsory rulebooks, in addition to whichever activity-specific rulebooks correspond to their licensed services.

Paid-up capital requirements range from AED100,000 to AED1.5 million, or 25% of fixed annual overheads, depending on the licensed activity, with reduced thresholds where client assets are held with a VARA-licensed custodian. Licensees must maintain net liquid assets of at least 1.2 times monthly operating expenses at all times, reserves equal to 100% of client liabilities held one-to-one in the corresponding virtual asset, and appropriate insurance, which may include professional indemnity, directors and officers liability, and commercial crime coverage.

Key personnel appointments require VARA approval through a fit-and-proper process. Mandatory roles include a full-time Compliance Officer, Money Laundering Reporting Officer (MLRO), Chief Information Security Officer, Data Protection Officer, and two full-time Designated Responsible Individuals. Core documentation requirements include a regulatory business plan with five-year financial projections, an anti-money laundering and counter-financing of terrorism framework covering customer due diligence and enhanced due diligence procedures and suspicious activity reporting, a cybersecurity framework supported by penetration testing evidence, and wallet custody and key management protocols.

CMA

CMA licence applicants must be legal entities incorporated on the UAE mainland outside Dubai, and must maintain a principal registered office from which effective management and daily operational decisions are conducted. Physical presence is required at the principal office and any branch, and additional branches within the UAE or in a financial free zone require the CMA’s prior approval.

Minimum capital for a Category 2 licence is the higher of AED1 million or 25% of projected annual operating expenses, rising to 35% where client assets are held. Required personnel include a Chief Executive, Senior Executive Officer, Finance Director, Compliance Officer, MLRO and Internal Auditor. The Chief Executive, Compliance Officer and MLRO must be ordinarily resident in the UAE. Certain function combinations are restricted, and all personnel performing regulated roles are subject to fit-and-proper assessment by the CMA.

Financial Free Zones

Both the FSRA and the DFSA impose their own licensing requirements on entities seeking authorisation to conduct virtual asset or crypto token activities in ADGM and the DIFC respectively, including substance, capitalisation, personnel and governance conditions calibrated to the nature of the licensed activity.

VASPs conducting regulated activities in the UAE are subject to change of control requirements imposed by their respective regulators. While the specific obligations vary between authorities, they generally require prior approval or notification for any direct or indirect change in ownership, any significant management or governance change, and any corporate restructuring affecting control of the entity.

UAE virtual asset licences do not passport into other jurisdictions, and there are no formal mutual recognition arrangements in place that would allow a UAE-licensed entity to conduct regulated virtual asset activities in a foreign jurisdiction on the basis of its UAE authorisation alone. Firms wishing to operate across borders must comply with the licensing requirements of each relevant jurisdiction.

Within the UAE, the CMA and VARA agreed a mutual recognition framework in August 2025 providing for the recognition of VASP licences issued by either authority and establishing joint processes for application review, compliance monitoring and enforcement coordination. In practice, this is intended to reduce duplication for firms active across both Dubai and the wider UAE mainland, though compliance with each regulator's substantive requirements remains necessary. Separately, VARA and the DFSA signed a memorandum of understanding in October 2025 at GITEX Global, establishing a framework for cooperation on licensing, supervision, enforcement and AML/CFT matters across Dubai and the DIFC. This is a coordination arrangement rather than a passporting regime, and entities operating in both jurisdictions continue to require separate authorisation from each regulator.

UAE regulators have entered into a range of bilateral memoranda of understanding with foreign counterparts for the purposes of information sharing and supervisory cooperation, but none of these arrangements confer any right for UAE-licensed firms to carry on regulated activities in those jurisdictions without local authorisation.

Onshore UAE

Virtual asset marketing is governed by VARA through its Regulations on the Marketing of Virtual Assets and Related Activities 2024 (Marketing Regulations), which apply across the onshore UAE. The rules cover any marketing or promotional activity related to virtual assets and services, whether conducted by UAE-based or foreign entities, and regardless of licensing status.

Only licensed VASPs or their authorised representatives may promote regulated activities such as exchange, brokerage or custody. Promotions by unlicensed VASPs are prohibited, and marketing by foreign firms is also restricted where it targets UAE residents, for example through AED pricing, UAE-based influencers or localised content.

VARA defines marketing broadly, covering social media, digital advertisements, public events, influencer promotions and traditional media. All marketing content must include clear and prominent risk disclaimers and avoid misleading language such as “guaranteed returns” or urgency tactics such as “limited-time offer”. Influencers must disclose paid partnerships, and comparisons or performance claims must be balanced and factual.

Unlicensed entities may conduct limited marketing at physical events in Dubai, subject to strict disclaimers and conditions. Record-keeping of marketing content and audience data is mandatory for at least eight years. Violations may result in substantial penalties, with repeat breaches leading to escalating fines or enforcement action. Exemptions exist for journalistic, educational and genuinely private communications, though these are narrowly interpreted. The promotion of privacy tokens is strictly prohibited.

Additional marketing provisions apply under the CBUAE’s PTSR, which restricts the promotion of payment token services to licensed or registered entities and imposes specific limits on the promotion of foreign payment tokens to UAE persons. The CMA’s VASP framework similarly includes conduct of business requirements governing the promotion of virtual asset services to clients, applicable to CMA-licensed entities operating on the UAE mainland.

There is no formal reverse solicitation exemption in UAE law equivalent to those found in certain other jurisdictions. The Marketing Regulations provide narrow exemptions for journalistic reporting, educational content and genuinely private communications, but these are interpreted restrictively and cannot be relied on as a basis for systematic cross-border promotion.

Financial Free Zones

Neither the DFSA nor the FSRA has issued digital-asset-specific marketing regulations. Firms licensed in ADGM and the DIFC are instead subject to general financial promotion and conduct of business rules under their respective regulatory frameworks, including restrictions on communications with clients and requirements that content be fair, clear and not misleading.

Firms based in ADGM or the DIFC may also be subject to VARA’s Marketing Regulations where their marketing activities are directed at onshore UAE residents.

The UAE’s virtual asset regulatory frameworks do not expressly address white-label arrangements. In practice, however, both VARA and the CMA permit such structures provided that all applicable regulatory requirements, including those relating to technology, cybersecurity, conduct of business and AML/CFT, are met in full. The licensed entity retains regulatory responsibility for the activities conducted under its licence, and the arrangement must be structured so that oversight and control remain with the licence holder. Firms considering white-label models are advised to engage with the relevant regulator at an early stage to confirm that the proposed structure is acceptable.

There is no general prohibition on the use of decentralised finance (DeFi) in the UAE. The regulatory frameworks across VARA, the CMA and the financial free zones do not expressly prohibit DeFi activity, and CeFi firms are not prevented from utilising DeFi protocols in connection with the products and services they provide, provided they continue to meet all applicable regulatory obligations, including those relating to AML/CFT, market conduct and client asset protection.

The principal exception is regulated payment services. Federal Decree-Law No 6 of 2025 expanded the CBUAE’s supervisory remit to cover payment activities conducted through decentralised mechanisms, meaning that the use of DeFi protocols in connection with payment services requires compliance with the CBUAE’s regulatory framework in the same manner as centralised payment service providers. Firms intending to use DeFi for payment-related activities should assess carefully whether CBUAE authorisation is required before doing so.

There are no corporate structures in the UAE specifically designed for DeFi, and no dedicated DeFi entity regime exists. However, two frameworks provide a legal basis for decentralised autonomous organisations.

Innovation City (formerly RAK DAO), a free zone in Ras Al Khaimah, introduced the DAO Associations Regime (DARe) in 2024, under which DAOs may be registered as associations with legal personality.

In ADGM, the Distributed Ledger Technology Foundations Regulations 2023 introduced the DLT Foundation, a legal entity with separate legal personality governed by a foundation council of between two and 16 councillors, an optional guardian, and tokenholders who may hold voting and information rights on matters including charter amendments and dissolution. The minimum initial asset value is USD50,000, payable in fiat currency only. A DLT Foundation must at all times maintain a registered office in ADGM and engage a licensed company service provider, subject to a substance-based exemption available where the foundation demonstrates adequate resources, experience and governance in the UAE. Audited annual accounts must be published on the foundation’s website and filed with the Registrar within six months of the financial year end.

Both regimes provide legal personality and governance frameworks suitable for decentralised projects, though neither confers any regulatory authorisation to conduct regulated virtual asset activities, which remain subject to the applicable licensing requirements.

In practice, it remains common for DeFi projects with a UAE nexus to adopt dual legal structures, combining a UAE entity (typically in a commercial free zone or ADGM) for development company operations, employment and commercial contracting, with an offshore entity for token issuance or as a protocol-level legal wrapper. Cayman Islands foundation companies and Swiss associations remain the most frequently used offshore vehicles for this purpose, given their established treatment of token issuance, governance flexibility and tax neutrality. 

There have been no judicial decisions or regulatory enforcement actions in the UAE specifically addressing accountability or liability in the context of DeFi, and the legal framework in this area remains untested.

Payments in crypto-assets occupy a developing and increasingly regulated space in the UAE. Virtual assets do not constitute legal tender, and the AED remains the only lawful means of settling debts. However, the use of virtual assets and payment tokens in commercial transactions is subject to a framework that continues to evolve.

Onshore UAE

VARA has introduced a dedicated framework for Asset-Referenced Virtual Assets (ARVAs) under the Virtual Asset Issuance Rulebook, which expressly captures tokens representing direct or indirect ownership of real-world assets, including real estate, commodities, bonds and other financial instruments. ARVAs are classified as Category 1 virtual asset issuances, requiring a VARA licence, a VARA-approved whitepaper, and compliance with the full suite of compulsory rulebooks.

The CMA has taken a targeted approach to tokenisation through Resolution No 15/Chairman of 2025, introducing a framework for Security Tokens and Commodity Contract Tokens. A Security Token is defined as a security whose rights are registered and transferable via a distributed ledger, with an equivalent definition applying to Commodity Contract Tokens. The framework expressly excludes virtual assets falling within the VASP framework, and tokenised real-world assets are similarly excluded unless the token represents a security or commodity contract. The CMA framework therefore covers tokenised equivalents of instruments already regulated as securities or commodity contracts, but does not extend to the broader RWA tokenisation space.

Financial Free Zones

In ADGM, the FSRA regulates tokenised securities as Digital Securities under the FSMR, applying the same requirements as those applicable to their non-tokenised equivalents. In the DIFC, the DFSA distinguishes between Security Tokens and Derivative Tokens, regulating each in line with the underlying instrument. In March 2025, the DFSA launched a dedicated Tokenisation Regulatory Sandbox, providing a structured pathway for firms to develop and test tokenisation models involving real-world assets under an Innovative Testing Licence.

Market Practice

The institutional RWA tokenisation market in the UAE is increasingly supported by specialist advisory platforms working with asset owners on end-to-end execution. The leading UAE-based example is RWALabs.ae, which advises issuers, asset owners and institutional capital on regulatory structuring, legal architecture and go-to-market strategy for institutional-grade RWA tokenisation across the VARA, CMA and ADGM perimeters.